What is the CVSS score of EUVD-2026-44052?

EUVD-2026-44052 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows ReFS are affected by EUVD-2026-44052?

A high-severity privilege escalation in Microsoft Windows ReFS exposes Windows 10, Windows 11, and Server 2016-2025 systems to unauthorized privilege elevation by authenticated users, creating…. A patch is available.

How to fix or mitigate EUVD-2026-44052?

Within 24 hours, identify and catalog all Windows 10, Windows 11, and Windows Server 2016-2025 systems in your environment. Within 7 days, deploy the Microsoft vendor patch to a representative test cohort of non-production systems to validate compatibility in your environment. Within 30 days, complete deployment of the patch across all affected production systems, prioritizing servers and high-value endpoints first.

Windows ReFS EUVD-2026-44052

| CVE-2026-50441 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-07-14 microsoft

GHSA-p772-w8jr-9x5v

Information Disclosure Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Local, low-complexity EoP by an authenticated user (AV:L/AC:L/PR:L, UI:N); kernel-context compromise yields full C/I/A impact within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:24 vuln.today

CVE Published

Jul 14, 2026 - 17:07 nvd

HIGH 7.8

DescriptionCVE.org

Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Resilient File System (ReFS) lets an authenticated local attacker gain elevated (SYSTEM-level) privileges by triggering an untrusted pointer dereference in the ReFS driver. It affects a broad range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently patch-and-move rather than emergency.

Technical ContextAI

ReFS (Resilient File System) is Microsoft's newer-generation filesystem, implemented as a kernel-mode driver and used primarily on Windows Server (Storage Spaces, backup targets, large data volumes) and available on modern Windows client editions. The root cause is CWE-822 (Untrusted Pointer Dereference): the driver dereferences a pointer whose value is derived from data the attacker can influence, rather than validating it against a trusted source. Because filesystem parsing runs in kernel context, a controlled dereference of attacker-influenced memory can corrupt kernel state and be steered into a privilege-escalation primitive. The CPE set confirms the affected surface spans Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016 through 2025 including Server Core installations.

RemediationAI

Apply the Microsoft security update for your specific Windows/Windows Server build (Patch available per vendor advisory) - see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50441 for the exact fixed build per SKU, as precise fixed version numbers are not included in the provided data. Because exploitation requires an existing local, authenticated foothold, meaningful compensating controls until patching is complete include restricting interactive and local logon rights on ReFS-hosting servers to trusted administrators, and enforcing least privilege so standard users cannot run arbitrary local code. Where operationally acceptable, hosting sensitive volumes on NTFS instead of ReFS removes exposure to this specific driver path, but that is a disruptive migration and only appropriate for new deployments, not a quick mitigation. Prioritize patching ReFS-enabled backup and storage servers where the driver is actively in use.